Zero Trust Architecture Explained: Policy Engine, PDP and PEP

Zero trust replaces implicit trust based on network location with explicit, continuous verification of every request. This article covers the architecture — the components and how a request flows through them. For threat scope reduction and the strategic case, see the companion article linked at the end.

The core principle

Traditional security assumed a trusted inside and an untrusted outside, enforced at a perimeter. Once past it, a user or device was broadly trusted. That model fails when applications are in SaaS, users are remote, and an attacker who phishes one credential inherits everything that credential can reach.

Zero trust starts from the assumption that the network is already hostile. No request is trusted because of where it came from. Every access decision is made explicitly, on current information, for that specific request.

The architecture

NIST SP 800-207 defines the model, and the component names appear in exam questions.

The architecture splits into a control plane, where decisions are made, and a data plane, where they are enforced.

Policy Engine (PE). Makes the decision — grant, deny or revoke access — by evaluating policy against the available signals. This is the brain.

Policy Administrator (PA). Executes the decision, establishing or tearing down the session and issuing credentials or tokens to the enforcement point.

Together the PE and PA form the Policy Decision Point (PDP).

Policy Enforcement Point (PEP). Sits in the data path between the subject and the resource, and actually permits or blocks the traffic. It enforces; it does not decide.

The flow: a subject requests a resource, the PEP intercepts and asks the PDP, the policy engine evaluates, the policy administrator instructs the PEP, and the PEP allows or blocks. The separation of decision from enforcement is the structural point the exam tests.

The trust algorithm

What the policy engine actually weighs. Inputs typically include the identity of the subject and their assigned privileges; the health and compliance state of the device; the sensitivity of the resource; behavioural history and current behaviour; threat intelligence; and environmental factors such as time and location.

Two evaluation styles appear in the standard. A criteria-based algorithm requires a defined set of conditions to be met. A score-based algorithm produces a confidence value and compares it against a threshold, which allows graduated responses — grant, grant with additional authentication, or deny.

The word continuous matters. Trust is re-evaluated during a session, not only at login. If device health degrades or behaviour becomes anomalous mid-session, access can be revoked.

The tenets

NIST lists seven, and they are worth knowing in substance rather than verbatim: all data sources and services are resources; all communication is secured regardless of network location; access is granted per session; access is determined by dynamic policy including observable state; the organisation monitors the integrity and posture of all assets; authentication and authorisation are dynamic and strictly enforced before access; and the organisation collects data about assets, traffic and access to improve its posture.

"Per session" and "dynamic policy" are the two that distinguish zero trust from simply having good access control.

What it looks like in practice

Identity as the primary control, with strong and ideally phishing-resistant multifactor authentication.

Device posture checks — is it managed, encrypted, patched, running current endpoint protection?

Microsegmentation so that reaching one workload does not grant reach to its neighbours.

ZTNA replacing traditional VPN. A VPN typically places the user on the network; ZTNA brokers access to a specific application without network-level access at all. This distinction is a likely exam point.

Least privilege and just-in-time access, so standing privilege does not exist to be stolen.

Comprehensive logging, because dynamic policy needs signals and because verification without visibility is guesswork.

Realistic limits

Worth stating, since exam questions sometimes test judgement. Zero trust is an architectural approach, not a product, and no single purchase delivers it. It is adopted incrementally — usually starting with identity and one high-value application — rather than as a rebuild. Legacy systems that cannot support modern authentication need compensating controls around them. And the policy decision point becomes critical infrastructure requiring its own resilience.

What to remember

Zero trust removes implicit trust based on network position and verifies every request explicitly and continuously. The policy engine decides, the policy administrator executes, and together they form the policy decision point; the policy enforcement point sits in the data path and enforces. The trust algorithm weighs identity, device posture, resource sensitivity and behaviour. ZTNA grants application access without network access.

Related reading: Threat scope reduction · Access control models · Defence in depth